CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Vulnerability discovered by executing a planned security audit. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.This issue affects Advanced Custom Fields PRO: from n/a before 6.2.10.
Explanation of Vulnerability in Simple Terms
Advanced Custom Fields Pro versions before 6.2.10 contain a path traversal vulnerability that allows authenticated users with low privileges to read, modify, or delete arbitrary files on the server. The vulnerability affects the file handling mechanism and can impact the confidentiality, integrity, and availability of the entire site due to scope change. Update to version 6.2.10 or later immediately.
What an attacker can do
Read, modify, or delete arbitrary files on the server, potentially compromising the entire site.
Potential impact on your site
Any authenticated user can access sensitive files, alter site configuration, or disable the site entirely.
Conditions required to exploit
Attacker must have a low-privilege authenticated account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
